echelon | 1da5a6aac7197d1fcadef018775831885b715d5c37a3115777dc5c717ce6e0da

General

Target

c481259ad199b773339f168902cc7437.exe
Size

267KB
MD5

c481259ad199b773339f168902cc7437
SHA1

4c9a81f2a9167f953109eddbd141ea8d078d13e9
SHA256

1da5a6aac7197d1fcadef018775831885b715d5c37a3115777dc5c717ce6e0da
SHA512

5bc8965e9aa550f3e37b312f3d4a6854b0002f42b5a111087a754e3ed7cdcf957b40f6bebc389b405317b46eeaed88132545732daac74723945591ae38cdcabf

Score

10^/10

echelon spyware stealer

Malware Config

Signatures

Echelon
Echelon is a .NET stealer that targets passwords from browsers, email and cryptocurrency clients.
stealer spyware echelon
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

16 api.ipify.org
15 api.ipify.org

flow	ioc
16	api.ipify.org
15	api.ipify.org

Suspicious use of NtSetInformationThreadHideFromDebugger 15 IoCs

Processes:

c481259ad199b773339f168902cc7437.exe

pid	process
648	c481259ad199b773339f168902cc7437.exe
648	c481259ad199b773339f168902cc7437.exe
648	c481259ad199b773339f168902cc7437.exe
648	c481259ad199b773339f168902cc7437.exe
648	c481259ad199b773339f168902cc7437.exe
648	c481259ad199b773339f168902cc7437.exe
648	c481259ad199b773339f168902cc7437.exe
648	c481259ad199b773339f168902cc7437.exe
648	c481259ad199b773339f168902cc7437.exe
648	c481259ad199b773339f168902cc7437.exe
648	c481259ad199b773339f168902cc7437.exe
648	c481259ad199b773339f168902cc7437.exe
648	c481259ad199b773339f168902cc7437.exe
648	c481259ad199b773339f168902cc7437.exe
648	c481259ad199b773339f168902cc7437.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

c481259ad199b773339f168902cc7437.exe

description pid process target process

PID 648 set thread context of 3304 648 c481259ad199b773339f168902cc7437.exe c481259ad199b773339f168902cc7437.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

416 648 WerFault.exe c481259ad199b773339f168902cc7437.exe
188 3304 WerFault.exe c481259ad199b773339f168902cc7437.exe
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

3328 timeout.exe

description	pid	process	target process
PID 648 set thread context of 3304	648	c481259ad199b773339f168902cc7437.exe	c481259ad199b773339f168902cc7437.exe

pid	pid_target	process	target process
416	648	WerFault.exe	c481259ad199b773339f168902cc7437.exe
188	3304	WerFault.exe	c481259ad199b773339f168902cc7437.exe

pid	process
3328	timeout.exe

Suspicious behavior: EnumeratesProcesses 33 IoCs

Processes:

c481259ad199b773339f168902cc7437.exeWerFault.exeWerFault.exe

pid	process
648	c481259ad199b773339f168902cc7437.exe
648	c481259ad199b773339f168902cc7437.exe
648	c481259ad199b773339f168902cc7437.exe
416	WerFault.exe
416	WerFault.exe
416	WerFault.exe
416	WerFault.exe
416	WerFault.exe
416	WerFault.exe
416	WerFault.exe
416	WerFault.exe
416	WerFault.exe
416	WerFault.exe
416	WerFault.exe
416	WerFault.exe
416	WerFault.exe
416	WerFault.exe
416	WerFault.exe
188	WerFault.exe
188	WerFault.exe
188	WerFault.exe
188	WerFault.exe
188	WerFault.exe
188	WerFault.exe
188	WerFault.exe
188	WerFault.exe
188	WerFault.exe
188	WerFault.exe
188	WerFault.exe
188	WerFault.exe
188	WerFault.exe
188	WerFault.exe
188	WerFault.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

c481259ad199b773339f168902cc7437.exeWerFault.exec481259ad199b773339f168902cc7437.exeWerFault.exe

description	pid	process
Token: SeDebugPrivilege	648	c481259ad199b773339f168902cc7437.exe
Token: SeRestorePrivilege	416	WerFault.exe
Token: SeBackupPrivilege	416	WerFault.exe
Token: SeDebugPrivilege	416	WerFault.exe
Token: SeDebugPrivilege	3304	c481259ad199b773339f168902cc7437.exe
Token: SeDebugPrivilege	188	WerFault.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

c481259ad199b773339f168902cc7437.execmd.exe

description	pid	process	target process
PID 648 wrote to memory of 744	648	c481259ad199b773339f168902cc7437.exe	cmd.exe
PID 648 wrote to memory of 744	648	c481259ad199b773339f168902cc7437.exe	cmd.exe
PID 648 wrote to memory of 744	648	c481259ad199b773339f168902cc7437.exe	cmd.exe
PID 744 wrote to memory of 3328	744	cmd.exe	timeout.exe
PID 744 wrote to memory of 3328	744	cmd.exe	timeout.exe
PID 744 wrote to memory of 3328	744	cmd.exe	timeout.exe
PID 648 wrote to memory of 3304	648	c481259ad199b773339f168902cc7437.exe	c481259ad199b773339f168902cc7437.exe
PID 648 wrote to memory of 3304	648	c481259ad199b773339f168902cc7437.exe	c481259ad199b773339f168902cc7437.exe
PID 648 wrote to memory of 3304	648	c481259ad199b773339f168902cc7437.exe	c481259ad199b773339f168902cc7437.exe
PID 648 wrote to memory of 3304	648	c481259ad199b773339f168902cc7437.exe	c481259ad199b773339f168902cc7437.exe
PID 648 wrote to memory of 3304	648	c481259ad199b773339f168902cc7437.exe	c481259ad199b773339f168902cc7437.exe
PID 648 wrote to memory of 3304	648	c481259ad199b773339f168902cc7437.exe	c481259ad199b773339f168902cc7437.exe
PID 648 wrote to memory of 3304	648	c481259ad199b773339f168902cc7437.exe	c481259ad199b773339f168902cc7437.exe
PID 648 wrote to memory of 3304	648	c481259ad199b773339f168902cc7437.exe	c481259ad199b773339f168902cc7437.exe

C:\Users\Admin\AppData\Local\Temp\c481259ad199b773339f168902cc7437.exe
"C:\Users\Admin\AppData\Local\Temp\c481259ad199b773339f168902cc7437.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:648
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c timeout 1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:744
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:3328
- C:\Users\Admin\AppData\Local\Temp\c481259ad199b773339f168902cc7437.exe
  "C:\Users\Admin\AppData\Local\Temp\c481259ad199b773339f168902cc7437.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3304
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3304 -s 1888
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:188
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 648 -s 2088
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:416

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/188-23-0x00000000040D0000-0x00000000040D1000-memory.dmp

Filesize
4KB

Download
memory/416-19-0x0000000004C50000-0x0000000004C51000-memory.dmp

Filesize
4KB

Download
memory/648-9-0x0000000009A40000-0x0000000009B96000-memory.dmp

Filesize
1.3MB

Download
memory/648-6-0x00000000099A0000-0x00000000099A1000-memory.dmp

Filesize
4KB

Download
memory/648-2-0x0000000073FF0000-0x00000000746DE000-memory.dmp

Filesize
6.9MB

Download
memory/648-3-0x0000000000550000-0x0000000000551000-memory.dmp

Filesize
4KB

Download
memory/648-12-0x000000000A2F0000-0x000000000A2F1000-memory.dmp

Filesize
4KB

Download
memory/648-5-0x00000000050D0000-0x00000000050D1000-memory.dmp

Filesize
4KB

Download
memory/744-10-0x0000000000000000-mapping.dmp

Download
memory/3304-14-0x000000000054706E-mapping.dmp

Download
memory/3304-15-0x0000000073FF0000-0x00000000746DE000-memory.dmp

Filesize
6.9MB

Download
memory/3304-18-0x00000000052F0000-0x00000000052F1000-memory.dmp

Filesize
4KB

Download
memory/3304-13-0x0000000000400000-0x000000000054C000-memory.dmp

Filesize
1.3MB

Download
memory/3304-20-0x0000000005BE0000-0x0000000005C51000-memory.dmp

Filesize
452KB

Download
memory/3304-21-0x0000000005270000-0x0000000005271000-memory.dmp

Filesize
4KB

Download
memory/3328-11-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads